You currently have javascript disabled. Several functions may not work. Please re-enable javascript to access full functionality.

Register a free account to unlock additional features at BleepingComputer.com

Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.

Please Help! Startpage-du.dll Is Ruining My Pc!

Hello to everybody!!I'm new here and i'm looking for helpPlease help me out how to remove this virus and get back to normal. i tried McAfee, adaware but nothing.I used to resolve this kind of virus by re-installing the whole system but i have so many programs and stuff on my hd that i can't lose all data.

1) Please print off these intructions - they will be needed later when internet access is not available.2) Save these instructions in word/notepad to the desktop where they can be easily found for the same reasons as above.At the moment you may feel like you battling with your computer to keep it running smoothly, but doing the following things should most certainly help getting it back to how it was

It may look like a lot below - follow the instructions as carefully as possible and everything should be kool!________________________________________________

Rightclick and choose "Properties". On the "General" tab under "Service Status" click the "Stop" button to stop the service. Beside "Startup Type" in the dropdown menu select "Disabled". Click Apply then OK. File-Exit the Services utility.

Note: You may get an error here when trying to access the properties of the service. If you do get an error, just select the service and look there in the top left of the main service window and click "Stop" to stop the service. If that gives an error or it is already stopped, just skip this step and proceed with the rest.

Boot into Safe Mode (start tapping the F8 key at Startup, before the Windows logo screen)

Double click on the cwsserviceremove.reg file you downloaded at the beginning to enter into the registry.......Answer yes when asked to have it's contents added to the registry

With IE closed, run Hijack This again. Put a checkmark on these entries and hit "fix checked":

Double-click on Killbox.exe to run it. Now put a tick by Standard File Kill. In the "Full Path of File to Delete" box, copy and paste each of the following lines one at a time then click on the button that has the red circle with the X in the middle after you enter each file. It will ask for confimation to delete the file. Click Yes. Continue with that same procedure until you have copied and pasted all of these in the "Paste Full Path of File to Delete" box.

Reboot and "copy/paste" a new log file into this thread, after completing any other instructions given

If you have Spybot S&D installed you will also need to replace one file. Go here: http://www.spywareinfo.com/~merijn/winfiles.htmlDownload SDHelper.dllCopy the file to the folder containing your Spybot S&D program (normally C:\Program Files\Spybot - Search & Destroy)

Check in the C:\Windows\system32 folder to be sure you have a file named Shell.dll. If you do not have one, go to the C:\Windows\system32\dllcache folder. Find shell.dll and right click on it. Choose Copy from the menu. Open the System32 folder and right click on an empty space in the window. Choose Paste from the menu.

First of all, thank you very much for your help David. I tried what you told me to do, but it seems i have more problems. I guess i did something wrong.I'm stuck with it on my computer. I couldn't get online till now because IE would load any page. Besides that there is another program that can't be stopped.The symptom is an item in your system tray that continuously pops-up a warning balloon "Your Computer is Infected" blah-blah. and when you click on it you are directed to

In the system tray, there are two icons that alternate: a blue globe; and a red circle with a white cross (or white X) There is no fixe yet on the web i think... the malware authors have some way of starting a process that is not showing up in the running process of the task manager

I can't thank you enough for the help you already gave me. And any othe help would be muvh appreciated and needed.

* Next go to Control Panel > Display. Click on the "Desktop" tab then click the "Customize Desktop" button. Click on the "Web" tab. Under "Web Pages" you should see an entry checked called something like "Security info" or similar. If it is there, select that entry and click the "Delete" button. Click OK then Apply and OK.

When the scan is finished, anything that it cannot clean have it delete it. Make a note of the file location of anything that cannot be deleted so you can delete it yourself.- Save the results from the scan!

Post a new HiJackThis log along with the results from ActiveScan and the ewido scan